CVE-2014-3956 The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access uninten...
LowCVSS 1.9
EPSS 0.63%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/sendmail(Debian:12) | < 8.14.4-6 | 8.14.4-6 |
| debian/sendmail(Debian:13) | < 8.14.4-6 | 8.14.4-6 |
| debian/sendmail(Debian:14) | < 8.14.4-6 | 8.14.4-6 |
| freebsd | <= 9.2 | No fix listed |
| HP Inc hpux | <= b.11.31 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| sendmail | <= 8.14.8 | No fix listed |
| sendmail | = 8.6.7 | No fix listed |
| sendmail | = 8.7.6 | No fix listed |
| sendmail | = 8.7.7 | No fix listed |
| sendmail | = 8.7.8 | No fix listed |
| sendmail | = 8.7.9 | No fix listed |
| sendmail | = 8.7.10 | No fix listed |
| sendmail | = 8.8.8 | No fix listed |
| sendmail | = 8.9.0 | No fix listed |
| sendmail | = 8.9.1 | No fix listed |
| sendmail | = 8.9.2 | No fix listed |
| sendmail | = 8.9.3 | No fix listed |
| sendmail | = 8.10 | No fix listed |
| sendmail | = 8.10.0 | No fix listed |
| sendmail | = 8.10.1 | No fix listed |
| sendmail | = 8.10.2 | No fix listed |
| sendmail | = 8.11.0 | No fix listed |
| sendmail | = 8.11.1 | No fix listed |
| sendmail | = 8.11.2 | No fix listed |
Show 34 more
| Product | Affected versions | Fixed in |
|---|---|---|
| sendmail | = 8.11.3 | No fix listed |
| sendmail | = 8.11.4 | No fix listed |
| sendmail | = 8.11.5 | No fix listed |
| sendmail | = 8.11.6 | No fix listed |
| sendmail | = 8.11.7 | No fix listed |
| sendmail | = 8.12.0 | No fix listed |
| sendmail | = 8.12.1 | No fix listed |
| sendmail | = 8.12.2 | No fix listed |
| sendmail | = 8.12.3 | No fix listed |
| sendmail | = 8.12.4 | No fix listed |
| sendmail | = 8.12.5 | No fix listed |
| sendmail | = 8.12.6 | No fix listed |
| sendmail | = 8.12.7 | No fix listed |
| sendmail | = 8.12.8 | No fix listed |
| sendmail | = 8.12.9 | No fix listed |
| sendmail | = 8.12.10 | No fix listed |
| sendmail | = 8.12.11 | No fix listed |
| sendmail | = 8.13.0 | No fix listed |
| sendmail | = 8.13.1 | No fix listed |
| sendmail | = 8.13.2 | No fix listed |
| sendmail | = 8.13.3 | No fix listed |
| sendmail | = 8.13.4 | No fix listed |
| sendmail | = 8.13.5 | No fix listed |
| sendmail | = 8.13.6 | No fix listed |
| sendmail | = 8.13.7 | No fix listed |
| sendmail | = 8.13.8 | No fix listed |
| sendmail | = 8.14.0 | No fix listed |
| sendmail | = 8.14.1 | No fix listed |
| sendmail | = 8.14.2 | No fix listed |
| sendmail | = 8.14.3 | No fix listed |
| sendmail | = 8.14.4 | No fix listed |
| sendmail | = 8.14.5 | No fix listed |
| sendmail | = 8.14.6 | No fix listed |
| sendmail | = 8.14.7 | No fix listed |
References
- Debian Security Tracker CVE-2014-3956 vendor-advisory
- advisories.mageia.org third-party-advisory
- FEDORA-2014-7093 third-party-advisory vendor-advisory
- openSUSE-SU-2014:0804 vendor-advisory
- openSUSE-SU-2014:0805 vendor-advisory
- packetstormsecurity.com third-party-advisory vdb-entry
- 57455 third-party-advisory
- 58628 third-party-advisory
- GLSA-201412-32 vendor-advisory
- FreeBSD-SA-14:11 vendor-advisory
- MDVSA-2014:147 vendor-advisory
- MDVSA-2015:128 vendor-advisory
- 67791 third-party-advisory vdb-entry
- 1030331 third-party-advisory vdb-entry
- www.sendmail.com patch vendor-advisory
- SSA:2014-156-04 vendor-advisory
- h20566.www2.hpe.com third-party-advisory
- bugs.debian.org issue-tracking